Insights
Short notes for people who run a business, not a security team. Dates are fictional examples for this concept.
4 March 2026
Fictional date
3 min read
People and process
The boring first hour
When something goes wrong, the first hour is rarely about technology. It is about who decides, who calls whom, and whether anyone remembers where the contact list is.
A good plan for the first hour fits on one page. It names a decider and a deputy, lists the three people to call, says what to switch off first and what to write down (times, screens, who saw what).
Write it, print it, and read it aloud once with the team. The reading aloud matters more than the page. If a step makes people hesitate, that is the step to fix.
11 February 2026
Fictional date
3 min read
Accounts and access
Second step first
If you can only change one thing this month, switch on a second step for email. Email resets every other password, so it is the door behind the doors.
Start with administrators and anyone who handles money. Choose a method people will actually use: an app prompt or a hardware key is better than a code by text message, but a code by text is far better than nothing.
Expect two or three complaints in the first week and almost none after. Write the reset routine down before you start, so that a lost phone is a short conversation.
20 January 2026
Fictional date
4 min read
Data and backups
A backup you have restored
Everyone has a backup. Fewer people have restored from one. The difference shows up on the worst possible day.
Pick a folder, a mailbox or a small system and restore it somewhere safe. Time it. Note what was missing and what surprised you. That single exercise usually finds a gap.
Also ask where the copy lives. If your everyday accounts can delete it, an unlucky afternoon can delete both. Keep one copy that they cannot change.
9 December 2025
Fictional date
3 min read
Devices and updates
Updates are a habit, not a project
Most updates are small and boring. The ones that matter are published long before they are used against anyone, which is why a month-old gap is the usual one.
Turn on automatic updates where you can. For the rest, choose a day of the month, give it an owner, and keep a short list of what was done.
The list is also your device inventory in disguise: what exists, who has it, when it was last touched.
18 November 2025
Fictional date
2 min read
Accounts and access
The leavers list
People leave well and sometimes badly. Either way, their access should end on a schedule, not by memory.
Keep a one-page list: email, files, chat, shared logins, the accounting tool, phone, laptop, keys. Give it an owner, and tick it on the last day.
Do the same in reverse for new starters, so that nobody is handed access by accident on their first morning.
28 October 2025
Fictional date
4 min read
People and process
Answering a customer’s security questionnaire
A larger customer sends a spreadsheet of questions. It is tempting to answer everything with yes.
Do the opposite: answer what is true, mark what is in progress, and say what you do not do. Buyers read hundreds of these; a precise honest answer stands out.
Use the questionnaire as a free to-do list. Every honest no is a task, and the order of tasks is usually obvious.